<div dir="ltr">
<p class="MsoNormal">For <i>malloc()</i> problem, I have done some tests with the code below, which is lightly
modified based on the testcase from commit r158136.</p>
<p class="MsoNormal">int CMPRegionHeapToStack_modified () {</p>
<p class="MsoNormal"> int x = 0;</p>
<p class="MsoNormal"> int *x1 =
malloc(8);</p>
<p class="MsoNormal"> int *x2 = &x;</p>
<p class="MsoNormal" style="text-indent:24pt">*x2 = 3;</p>
<p class="MsoNormal" style="text-indent:24pt">*x1 = 2;</p>
<p class="MsoNormal"> free(x1);</p>
<p class="MsoNormal"> return x;</p>
<p class="MsoNormal">}</p>
<p class="MsoNormal">When evaluating the write operation in ‘*<i>x2 = 3;</i>’, I could got the MemRegion of <i>x</i>, which is actually the MemRegion
referred by <i>x2</i>. Then I tried to get
the super region of <i>x</i>. Consequently,
I got the <i>StackLocalsSapaceRegion, </i>which
conforms to my expectation. However, then I tried to do the same things on ‘<i>*x1 = 2</i>’ and <i>x1</i>. Firstly, I got <i>element{SymRegion{conj_$2{void
*}},0 S32b,int}</i>, which is the MemRegion referred by <i>x1</i> via <i>malloc()</i>. Then I
tried to get the super region of <i>SymRegion{conj_$2{void
*}}. </i>What I got is <i>UnkonwnSpaceRegion</i>.
In my expectation, the result should be <i>HeapSapceRegion</i>.
In a nutshell, from the result, it seems that Static Analyzer thought the
parent of <i>SymRegion{conj_$2{void *}}</i>
(referred by <i>x1</i> via <i>malloc()</i>) is <i>UnkonwnSpaceRegion,</i> rather than<i>
HeapSapceRegion. </i>I don’t know why… </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">For the problem of <i>isInSystemHeader()</i>
of CallEvent, I did this in the checkPreCall(). Here is my code.</p>
<p class="MsoNormal">void MyChecker::checkPreCall(const CallEvent &Call,
CheckerContext &C) const {</p>
<p class="MsoNormal"> if(Call.isInSystemHeader())
{</p>
<p class="MsoNormal" style="text-indent:21pt"> return;
/* Ignore the system function calls */</p>
<p class="MsoNormal" style="text-indent:21pt">}</p>
<p class="MsoNormal" style="text-indent:21pt"> </p>
<p class="MsoNormal" style="text-indent:21pt">/* Here is the code for the
function calls not in the system header */</p>
<p class="MsoNormal"> std::cout
<< “Call.isInSystemHeader() is false\n”;</p>
<p class="MsoNormal" style="text-indent:21pt">……</p>
<p class="MsoNormal">}</p>
<p class="MsoNormal">My test code contains some system function calls, such as <i>scanf(), printf(), malloc()</i> and etc. When
evaluating these function calls, the checkPreCall() did’t return directly. On
the contrary, the checker continued to do the things that for non-system
function calls. So it doesn’t work and confused me. It seems that Static
Analyzer cannot tell whether a function call is in system header rightly with <i>isInSystemHeader()</i>. I did this test on
the LLVM/Clang 3.4.2 downloaded from <a href="http://llvm.org/releases/download.html%233.4.2">http://llvm.org/releases/download.html#3.4.2</a>.
</p>
<div class="gmail_extra"><br><br><div class="gmail_quote">2014-06-24 4:52 GMT+08:00 Anna Zaks <span dir="ltr"><<a href="mailto:ganna@apple.com" target="_blank">ganna@apple.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word"><br><div><div class=""><blockquote type="cite"><div>On Jun 23, 2014, at 9:37 AM, Arthur Yoo <<a href="mailto:phjy007@gmail.com" target="_blank">phjy007@gmail.com</a>> wrote:</div><br>
<div><div dir="ltr"><p class="MsoNormal">Hi all, </p><p class="MsoNormal">I have some problem on the result of Clang Static Analyzer
dealing with malloc(). Here is the
simple test code, which I tried:</p><p class="MsoNormal">int *pi;</p><p class="MsoNormal">pi = (int *)malloc(sizeof(int));</p><p class="MsoNormal">*pi = 8;</p><p class="MsoNormal">free(pi);</p><div> <br></div><p class="MsoNormal">
The <i>pi</i> is a
pointer variable. After malloc() being called, <i>pi</i> points to an object which is located on the heap. However, in
the Clang Static Analyzer, I found that after malloc() being called, <i>pi</i> pointed to<i> element{SymRegion{conj_$2{void *}},0 S32b,int}</i>. Then I tried to
get the super region of <i>SymRegion{conj_$2{void
*}}. </i>What confused me is that, the super region of <i>SymRegion{conj_$2{void *}}</i> was <i>UnkonwnSpaceRegion</i>.
I thought its super region should be HeapSapceRegion, because I use malloc()
for dynamic memory allocation in the code. But now I get the different result. So
I wonder how does Static Analyzer deal with malloc()? Does Static Analyzer
regard malloc() as an ordinary function which returns an pointer?</p></div></div></blockquote></div>You can find out more about how heap region is used and constructed from commit r158136. The SymRegion should have heapRegion() as it's parent. Maybe the printing is off?</div>
<div><div class=""><br><blockquote type="cite"><div><div dir="ltr"><div> <br></div><p class="MsoNormal">What’s more, I have a question on the method<i> isInSystemHeader()
</i>of CallEvent. I use it to test whether the CallEvent is an system function call,
such as <i>scanf(), printf()</i> and etc. But it seems it does work. It seems that
Static Analyzer cannot tell whether a function call is in system header rightly.
And my Clang version is 3.5. </p><div> <br></div></div></div></blockquote><div><br></div></div><div>It should work. How are you testing this? </div><br><blockquote type="cite"><div><div class=""><div dir="ltr"><p class="MsoNormal">
Thanks a lot.</p>
<div><br></div>-- <br><div dir="ltr"><font color="#444444">Best regards,</font><div><font color="#444444">Arthur Yoo</font></div></div>
</div></div>
_______________________________________________<br>cfe-dev mailing list<br><a href="mailto:cfe-dev@cs.uiuc.edu" target="_blank">cfe-dev@cs.uiuc.edu</a><br><a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev</a><br>
</div></blockquote></div><br></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><font color="#444444">Best regards,</font><div><font color="#444444">Arthur Yoo</font></div></div>
</div></div>